No Patch, Live Attacks: What the Exchange Zero-Day and 18-Year-Old NGINX CVE Mean For Your Business

On 21 May 2026, three serious CVEs landed on enterprise security teams' desks inside a 24-hour window. Each one tells a different story — and each one underscores a risk that "we already manage this" operations actually don't.

This article walks through the three CVEs one at a time, shows which organisations they affect and to what degree, and outlines the structural response — beyond the patch cycle — required by UK GDPR, NIS2, Cyber Essentials, the EU AI Act, and Turkey's KVKK. It closes with the operational approach SBH Horizon brings to situations like this.

---

Three CVEs, three different stories

CVE-2026-42897 — Exchange Server zero-day (no patch, active exploitation)

A zero-day affecting Microsoft Exchange Server (2016, 2019, and Subscription Edition) on-premise OWA is under active exploitation without a public patch. The attack vector is typical: a malicious link or embedded content targets an OWA session, JavaScript injection leaks session information and potentially credentials.

Microsoft's official advisory does not yet include a patch — only workaround recommendations (limiting external OWA access, placing it behind a WAF, sanitising user inputs). Threat actors are not waiting for the patch, which makes this CVE a live example of the "no patch, live attacks" category.

Who is affected: Any organisation running on-premise Exchange. Exchange Online (Microsoft 365) customers are not affected; for that kind of managed SaaS service, patches roll out horizontally.

NGINX's 18-year-old DoS/RCE vulnerability — discovered by AI

Perhaps the most striking of the three CVEs is a denial-of-service flaw that has lived for 18 years in a code path at the core of NGINX, undetected by every traditional security audit. Worse, under specific conditions, it has been shown to escalate to remote code execution.

What makes this discovery unusual? According to BleepingComputer, the vulnerability was found by an autonomous AI agent. Not a human security researcher. Eighteen years of hundreds of thousands of manual code reviews missed this flaw; an AI scanning system caught it on its first pass.

This collapses an assumption security teams have leaned on for a long time: "mature, open-source, widely-reviewed software" can be assumed safe. NGINX is among the most widely deployed web-server / reverse-proxy components in the world. This 18-year-old flaw escaped a single security audit, every bug bounty programme, and the maintainers of Linux distributions for nearly two decades.

Who is affected: Any web/application infrastructure running NGINX that has not applied the patch. Organisations on managed distributions — Ubuntu LTS, Debian Stable, RHEL — are likely already patched if automatic security updates are enabled. Organisations running custom-compiled NGINX or freezing older versions need urgent patch action.

Cisco SD-WAN's sixth zero-day of the year (CVE-2026-20182)

The sixth zero-day discovered in Cisco SD-WAN in 2026. This time it is a privilege escalation scenario in the network management layer. Cisco PSIRT released an urgent advisory and the patch is available.

A single zero-day might not draw much attention — but six in one vendor over one year is a structural signal: the SD-WAN product family is under sustained adversarial focus. Cisco can manage this (the PSIRT advisory ecosystem works), but it does underscore that organisations using Cisco SD-WAN need to consolidate their patch cycle.

Who is affected: Organisations using Cisco SD-WAN-based enterprise network infrastructure. Mostly mid-market and enterprise; this category is rare in smaller businesses.

---

What do these three CVEs say together?

Three different stories, three different patch states — but a common message underneath: dependency visibility and continuous monitoring are no longer optional.

1. The "no patch" scenario is no longer rare

Exchange CVE-2026-42897 is the third "advisory exists but no patch" scenario observed in the past six months. The pattern is multiplying across major vendors — Microsoft, Cisco, Fortinet, others. When a CVE drops, "wait for the patch, then apply" is now a risk decision — taken deliberately, not by default.

Operational consequence: organisations need to have decided in advance what they will do during the patch-waiting window. Can a WAF rule scale horizontally? Can an IP allowlist be tightened? Can user access patterns be temporarily restricted? If these decisions are made ad-hoc after the advisory drops, defence is usually late.

2. The "known safe" infrastructure fallacy

An NGINX flaw hidden for 18 years calls into question the entire industry's "mature, open-source, widely-reviewed = safe" equivalence. AI-driven code scanning offers qualitatively different scope than human review — and this is not just an academic observation; it produced a concrete CVE.

The implication: organisations need to take AI-driven security tools seriously, and abandon the assumption that "mature components are safe." For patch-fatigued teams this is a hard message; but the reality is that risks in the dependency layer must be evaluated not only by recent-CVE timestamps but by what is not yet known.

3. Vendor zero-day accumulation is not a one-off

Six Cisco SD-WAN zero-days in one year is a structural vendor-concentration signal. Heavy dependence on a single vendor means that when that vendor's security posture deteriorates, all of your infrastructure is affected. This risk is evolving faster than many organisations think.

---

UK + EU + US + TR perspective — what do regulators require?

SummitBridge Horizon is a UK firm serving four jurisdictions. The same CVEs trigger different obligations in each.

UK GDPR + NIS Regulations

UK GDPR Article 32 (security of processing) and the UK NIS Regulations 2018 require "appropriate technical and organisational measures." Under ICO interpretation, failing to act on a known CVE within a reasonable timeframe can lead to an "appropriate measures not taken" finding during an audit. NCSC's Cyber Essentials scheme codifies the Patch Management control in exactly this frame: a 14-day patch window for high/critical vulnerabilities.

EU NIS2 Directive (2022/2555) + EU AI Act (2024/1689)

Among the 10 mandatory measures in NIS2 Article 21, "vulnerability handling and disclosure" requires organisations to operate their CVE management process in a documented and auditable form. Article 23's 24-hour / 72-hour / 1-month incident notification thresholds activate when response to an actively-exploited CVE fails.

The EU AI Act, in turn, has now brought Article 15 "robustness, accuracy, cybersecurity" obligations into force for organisations using AI-oriented infrastructure. Vulnerabilities in the dependencies that support AI systems are now a distinct compliance category.

US SEC and sectoral regulators

In the US, the SEC's 2023 Cybersecurity Risk Management Disclosure Rule requires public companies to disclose "material" security incidents via Form 8-K within 4 business days. Incidents arising from CVE exploitation can hit this threshold. At sector level, HIPAA (healthcare), GLBA (financial services), and CCPA (California) impose additional obligations.

TR KVKK + Turkey's Cybersecurity Law 7545

Turkey's KVKK Authority expects known vulnerabilities to be patched within a reasonable timeframe under its "data security measures" framework. The 2024 Cybersecurity Law 7545 introduced additional notification obligations for critical infrastructure owners. Turkish SMEs trading with the EU are also directly affected by NIS2's supply-chain reach.

---

Practical playbook — what should you do today?

Whatever jurisdiction you operate in, the three CVEs together suggest four practical steps:

1. Inventory your dependencies (today)

If you cannot answer with a single command which version of NGINX, Exchange, Cisco SD-WAN, and similar components you run, that is the first problem. Automated dependency scanning (Snyk, Dependabot, GitHub Advanced Security, JFrog Xray — commercial and open options exist) at least establishes the "I know" baseline. Without a dependency inventory, CVE management stays reactive.

2. Wire CVE feeds into your operational flow

NVD JSON 2.0 (free), GitHub Advisory Database (free), Snyk Open Source Vulnerability Database (commercial), CISA KEV (Known Exploited Vulnerabilities — the gold standard for critical priority). Integrating these feeds into Slack/Teams/Telegram means your team knows when a new CVE drops. "Weekly review" is no longer fast enough.

3. Prepare for no-patch scenarios

As in the Exchange CVE, you need to be ready for "exploitation starts before the patch ships." Being able to update WAF rule sets based on advisories, tighten IP allowlists per report, temporarily restrict user access patterns — these all need to be pre-rehearsed procedures. Making these decisions for the first time during an incident is too late.

4. Documentation + auditability

NIS2, UK GDPR Article 32, KVKK, and the SEC Cyber Disclosure Rule all share a common requirement: document what you did. When an auditor asks "how did you respond to Exchange CVE-2026-42897?", you need to be able to show a decision document + workaround logs + timeline. Without these, "we handled it" is not enough.

---

The SummitBridge Horizon approach

SummitBridge Horizon Ltd is a UK firm providing IT and cybersecurity advisory across UK + EU + US + TR jurisdictions (Companies House 16419201, ICO ZC112810). Our answer to the operational questions these CVEs raise works across three layers:

Proactive monitoring layer: Automated scanning systems that continuously monitor our clients' dependency inventories. When a new CVE drops, we deliver a 24-hour-graded email with priority scoring of its impact on the client's specific stack.

Monthly CISO report: Each month we compile the client's infrastructure security posture — patch level, open CVE count, compliance gap, changes made over the previous month — into an executive-readable report. This creates a record that serves both internal audit and regulator submission.

Incident response procedures: In "no patch" scenarios like Exchange CVE-2026-42897, the client's predefined workaround/mitigation procedures activate. Decisions are not made on the fly; they are executed from a plan.

This approach is integrated into the products we've shipped over the past year — cyber-essentials-monitoring, it-health-scanner-pro, cyber-risk-scorer. To see which suits your business, we offer a 15-minute free scoping call: /agents/qualify.

---

Closing

The core message of this article is not about a single CVE or a single vendor. The message is this: security is no longer an event-triggered reactive discipline; it is a continuous, operational, documented process. Dependency visibility, CVE monitoring, no-patch readiness, auditable record — these are four disciplines operating at four different time scales. An organisation that cannot run all four in coordination will always respond late to the next CVE.

The bigger picture revealed by the AI agent that found NGINX's 18-year-old vulnerability is simple: the dependency stack grows more complex every year, and the tools that manage that complexity are changing too. Maintaining the old balance requires adopting the new tools. The cost for organisations that fall behind is not just patch labour — it is the broader account that includes regulatory risk, customer trust, and brand reputation.

At SummitBridge Horizon we exist to be the partner that helps you stay on the front edge of that account. To start the conversation, [email protected] is open — or book a 15-minute scoping call directly.

---

This article provides general information; it does not constitute legal, financial, or operational advice. For situation-specific guidance, work with qualified counsel. SummitBridge Horizon Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ — UK.